Cisco Virtual Office: High Availability Design Guide

Contents DMVPN Redundancy... 3 Dual (or multiple) hubs, single cloud... 3 Public Key Infrastructure High Availability... 7 ManageExpress Virtual Office (MEVO) High Availability... 8 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 2 of 8

DMVPN Redundancy Dual (or multiple) hubs, single cloud Use this model if all your spokes will use the same hub as primary. This model applies whether the hubs are colocated in the same data center or in different, geographically separated, data centers. Each spoke will have one multipoint Generic Router Encapsulation (mgre) tunnel interface (DMVPN cloud) configured with two next-hop servers, and will have simultaneous active connections to both hubs. The routing metrics on the hub routers can be used to specify which hub is primary (lower metric) and which hub is secondary. Sample spoke tunnel configuration: interface Tunnel1 description Spoke Tunnel ip address 10.1.1.3 255.255.255.0 ip hello-interval eigrp 99 30 ip nhrp map multicast 192.168.1.1 ip nhrp map multicast 192.168.1.2 ip nhrp map 10.1.1.1 192.168.1.1 ip nhrp map 10.1.1.2 192.168.1.2 ip nhrp network-id 123 ip nhrp holdtime 300 ip nhrp nhs 10.1.1.1 ip nhrp nhs 10.1.1.2 ip nhrp registration no-unique ip nhrp shortcut load-interval 30 delay 2000 tunnel source FastEthernet4 tunnel key 123 tunnel protection ipsec profile protect Sample hub tunnel configuration Primary Hub: interface Tunnel1 ip address 10.1.1.1 255.255.255.0 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 3 of 8

ip hello-interval eigrp 99 30 no ip split-horizon eigrp 99 ip pim dr-priority 10 ip pim nbma-mode ip pim sparse-dense-mode ip nhrp map multicast dynamic ip nhrp network-id 123 ip nhrp redirect delay 1900 qos pre-classify tunnel source Loopback1 tunnel key 123 tunnel protection ipsec profile protect shared Secondary Hub: interface Tunnel1 ip address 10.1.1.2 255.255.255.0 ip hello-interval eigrp 99 30 no ip split-horizon eigrp 99 ip pim dr-priority 10 ip pim nbma-mode ip pim sparse-dense-mode ip nhrp map multicast dynamic ip nhrp network-id 123 ip nhrp redirect delay 2000 qos pre-classify tunnel source Loopback1 tunnel key 123 tunnel protection ipsec profile protect shared 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 4 of 8

Dual (or multiple) hubs, dual clouds Use this model if you have geographically dispersed spokes and you want each region to connect to a different primary DMVPN hub.the use case can be described in the diagram provided below. Each spoke will have simultaneous active connections to both clouds, and each hub will belong to only one cloud. For the East Coast spoke, the East Coast cloud will act as primary, and the west coast cloud will provide failover and vice versa for the west coast spoke. Each cloud will: Represent one tunnel interface configuration on the spoke. Have a separate tunnel IP address Use a different metric for its tunnel interface The primary and failover cloud is selected by utilizing the tunnel metric. For the primary, the metric will be set to a lower value than the cloud that is further away. Sample spoke tunnel configurations using Enhanced Interior Gateway Protocol (EIGRP): interface Tunnel0 description Primary Tunnel ip address 10.1.1.3 255.255.255.0 ip hello-interval eigrp 99 30 ip nhrp map multicast 192.168.1.1 ip nhrp map 10.1.1.1 192.168.1.1 ip nhrp network-id 123 ip nhrp holdtime 300 ip nhrp nhs 10.1.1.1 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 5 of 8

ip nhrp registration no-unique ip nhrp shortcut load-interval 30 delay 1900 tunnel source FastEthernet4 tunnel key 123 tunnel protection ipsec profile protect shared interface Tunnel1 description Secondary Tunnel ip address 10.50.50.3 255.255.255.0 ip hello-interval eigrp 99 30 ip nhrp map multicast 172.16.1.1 ip nhrp map 10.50.50.1 172.16.1.1 ip nhrp network-id 567 ip nhrp holdtime 300 ip nhrp nhs 10.50.50.1 ip nhrp registration no-unique ip nhrp shortcut load-interval 30 delay 2000 tunnel source FastEthernet4 tunnel key 567 tunnel protection ipsec profile protect shared Note: If asymmetric routing between the West Coast spokes and East Coast spokes (shown in the figure above) should be avoided, make sure that the sum of the metrics on the link between the hubs and the link between each regional hub and its corresponding spokes is less than the metric on the link between the hub in one region and the spokes in the other region. Looking at the figure below, make sure that X+Y<Z. 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 6 of 8

Public Key Infrastructure High Availability When using a Cisco IOS Certificate Authority (CA) in Cisco Virtual Office, high availability can be achieved using the Public Key Infrastructure (PKI)-HA feature. Please refer to the following guide for more details on PKI-HA. The Secure Device Provisioning (SDP) registrar should be provisioned on both the primary and backup CAs: http://www.cisco.com/en/us/prod/collateral/iosswrel/ps6537/ps6586/ps6638/ps6664/configuration_guide c07_62 1400.html 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 7 of 8

ManageExpress Virtual Office (MEVO) High Availability MEVO doesn t sit in the data/critical path in Cisco Virtual Office. If the MEVO server goes down, the spokes that are already online will not be affected. The only functions affected will be the addition of new spokes, and configuration and image changes. With that in mind, it is enough to backup the MEVO database and restore it in case the server goes down, as shown in this document (use your Arcana Networks download credentials to download the file): http://downloads.arcananet.com/files/docs/me-backupprocedure.pdf. A MEVO backup can be done while the service is running, without causing any outage. In the case where a MEVO active/active HA is still desired, here are deployment options you can use: Vmware vmotion Microsoft SQL merge replication (log shipping is also supported for an active/standby model) Windows DFS for template and configuration file replication Windows NLB for providing a single virtual IP address. Content switches and clustered SQL servers are also supported. The SQL cluster can be shared or dedicated. Preferred OS: Windows 2008R2 Preferred database: Microsoft SQL 2008R2 Printed in USA C07-708674-00 06/12 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 8 of 8